Commit 2170a1f09148 ("net: no longer reset transport_header in __netif_receive_skb_core()") stopped the receive path from pretending that an unset transport header starts at the network header - but only on CONFIG_DEBUG_NET=y builds, the idea being that fuzzers and CI could catch stacks reading a transport header where none was ever established. And the plan is to drop this for release as well. Indeed, under KASAN, an access through the unset offset produces a slab-out-of-bounds splat, which is how these bugs are usually found. But a regular debug build has no such safety net: the accesses land at skb->head + 0xffff, some 64K past the packet data. I don't think release builds are exposed to oob in this way, but I want to make the stack a bit more robust if yes. While I appreciate a nice KASAN splat as much as the next developer, making even a debug kernel do oob accesses was never the point of the exercise. Make skb_transport_header(), and its inner variant, verify and WARN, then fall back to the network header position when the transport header was not set. This way, accesses stay within the packet. An extra benefit is that release and debug kernels now behave identically if an unset transport header is ever reached, avoids heisenbugs. Fixes: 2170a1f09148 ("net: no longer reset transport_header in __netif_receive_skb_core()") Cc: Eric Dumazet Signed-off-by: Michael S. Tsirkin Co-Authored-By: Claude Code --- include/linux/skbuff.h | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index a3ff380d43f0..cbfeb17d86f7 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -2993,6 +2993,12 @@ static inline void skb_reset_mac_len(struct sk_buff *skb) static inline unsigned char *skb_inner_transport_header(const struct sk_buff *skb) { + if (unlikely(skb->inner_transport_header == + (typeof(skb->inner_transport_header))~0U)) { + DEBUG_NET_WARN_ON_ONCE(1); + return skb->head + skb->inner_network_header; + } + return skb->head + skb->inner_transport_header; } @@ -3072,7 +3078,11 @@ static inline void skb_unset_transport_header(struct sk_buff *skb) static inline unsigned char *skb_transport_header(const struct sk_buff *skb) { - DEBUG_NET_WARN_ON_ONCE(!skb_transport_header_was_set(skb)); + if (unlikely(!skb_transport_header_was_set(skb))) { + DEBUG_NET_WARN_ON_ONCE(1); + return skb->head + skb->network_header; + } + return skb->head + skb->transport_header; } -- MST